The Open Web Application Security Project (OWASP) is a 501c3 not-for-profit worldwide charitable organization focused on improving the security of application software. Our mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.

Wednesday, January 30, 2013

OWASP Zed Attack Proxy v 2.0.0

There is a new version of the OWASP Zed Attack Proxy (ZAP) available right now, and there are so many changes in it that we’ve decided to call it version 2.0.0.If you just want to get stuck in and download it then head over to http://code.google.com/p/zaproxy/downloads/list : it's available for Windows, Linux and Mac OS.

(Note that the Mac OS specific release is coming soon, but the Linux release is actually cross platform and will work fine on Macs)And if you want to learn a bit more about the changes then read on...We can only cover the new features at a high level in one blog post, but the plan is to host a Google hangout demonstrating many of these features at 17:00 UTC on Friday 8th Feb. Details to be announced via https://twitter.com/zaproxy

New features

An integrated add-ons marketplace

ZAP
can be extended by add-ons that have full access to all of the ZAP
internals. Anyone can write add-ons and upload them to the ZAP Add-on
Marketplace (OK, so its a Google code project called zap-extensions, but
you get the idea).

More
importantly you can now browse, download and install those add-ons from
within ZAP. Most add-ons can be dynamically installed (and uninstalled)
so you wont even need a restart.

You
can choose to be notified of updates, and even be automatically
updated. And as the scan rules are now implemented as add-ons you can
get the latest rules as soon as they are published.

A replacement for the 'standard' Spider

The ‘old’ Spider was showing its age, so its been completely rewritten, and is much faster and more comprehensive than the old one. This is still a 'traditional' spider that analyses the HTML code for any
links it can find.

A new 'Ajax' spider

In addition to the 'traditional' spider we've added an Ajax spider which is more effective with applications that make heavy use of JavaScript. This uses the Crawljax project which drives a browser (using Selenium) and so can discover any links an application generates, even ones generated
client side.

Web Socket support

ZAP now supports WebSockets, so ZAP
can now see all WebSocket messages sent to and from your browser. As with HTTP based messages, ZAP can also intercept WebSocket messages and allows you to change them on the fly.

You can also fuzz
WebSockets messages as well using all of the fuzzing payloads included
in ZAP from projects like JBroFuzz and fuzzdb. And of course you can
easily add your own fuzzing files.

Quick Start tab

The first main tab you will now see is a ‘Quick Start’ tab which allows you to just type in a URL and scan it with one click.

This is an ideal starting point for people new to application security, but experts can easily remove it if they find it distracting.

Session awareness

ZAP is now session aware, so it can
recognise and keep track of multiple sessions. It allows you to create new sessions, switch between them,
and applies to all of the other components, like the Spider and Active
Scanner.

User defined Contexts

You
can now define any number of ‘contexts’ - related sets of URLs which
make up an application. You can then target all URLs in a context, for
example using the Spider or Active Scanner. You can also add the
contexts to the scope, and associate other information, such as
authentication details.

Session scope

The
session scope allows you to specify which contexts you are interested
at any one time. You can restrict what you see in various tabs to just
the URLs in scope, and prevent accidentally attacking URLs not in scope
by using the Protected mode.

Different modes

ZAP now supports 3 modes:

Safe, in which no potentially dangerous operations permitted

Protected, in which you can perform any actions on URLs in scope

Standard, in which you can do anything to any URLs

A scripting console

This allows you to access any internal ZAP data structures dynamically using any scripting language that supports JSR 223,

Authentication handling

You
can now associate authentication details with any context, which allows
ZAP to do things like detect if and when you are logged out and
automatically log you back in again. This is especially useful when used
via the API in security regression tests.

More API support

The REST API has been significantly extended, giving you much more access to the functionality ZAP provides.

Fine grained scanning controls

The
active scan rules can now be tuned to adjust their strength (the number
of attacks they perform) and the threshold at which they report
potential issues.

Many thanks to everyone who has contributed code, language files, enhancement requests, bug reports and general feedback.And a special mention to the 3 Google Summer of Code students who implemented key features in this release:

Cosmin Stefan : Spider and Session awareness

Guifre Ruiz : Ajax Spider

Robert Koch : WebSockets

If you have any questions about this release then you can add a comment here or post them to theZAP users group.

Note that I'm no longer going to do a Google Hangout as the resolution proved to be too poor. Instead I'm recording a video which I'll upload to the ZAP Tutorials on Youtube: http://www.youtube.com/playlist?list=PLEBitBW-Hlsv8cEIUntAO8st2UGhmrjUB&feature=view_all